CVE-2023-2551

CVE-2023-2551 affects the PHP-based Bumsys (unilogies/bumsys) with versions prior to 2.1.1. The vulnerability stems from an API endpoint that processes file paths and allows local files to be included, enabling remote code execution via crafted requests to the api route. The root cause is unsafe ...

CVE-2023-2552

CVE-2023-2552 describes a CSRF vulnerability in unilogies/bumsys prior to 2.1.1. Connected sources provide a PoC: an attacker can reach ajax.php via /accounts/ajax without CSRF token, bypassing the check, potentially enabling unauthorized actions side-channel via a crafted request. The vulnerabil...

CVE-2023-1362

CVE-2023-1362 affects unilogies/bumsys prior to v2.0.2. The root cause is improper restriction of rendered UI layers or frames, enabling clickjacking. Public references in NVD/Red Hat/Nuclei templates describe the issue and indicate upgrade to version 2.0.2 or later as the remediation. CVSS v3.1 ...

CVE-2023-0455

CVE-2023-0455 affects unilogies/bumsys prior to v1.0.3-beta. Affected: the upload mechanism for shop logos (settings/shop-list) that accepts a file named profile picture.php with PHP code, indicating unrestricted upload of a dangerous file type. Root cause: insufficient validation of file type/ex...